The vulnerability in passport-saml-encrypted (<=0.1.13) arises from improper verification of cryptographic signatures in SAML messages. The signature verification and assertion extraction use separate XPath lookups without cross-checking, enabling an attacker to prepend a forged unsigned assertion to a validly signed SAML message. The system accepts the forged assertion as the authenticated identity while the genuine signature validates the original assertion, effectively allowing identity spoofing.

An attacker who can obtain any validly signed SAML message can exploit this flaw to impersonate arbitrary users by injecting a forged unsigned assertion. This compromises authentication integrity and can lead to unauthorized access to systems relying on passport-saml-encrypted for SAML authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or implement additional validation to ensure signature and assertion bindings are cross-verified.